The invention relates more particularly, but not exclusively, among these installations because it is in their case that its application seems to offer the greatest interest, to those equipping hotels comprising a large number of rooms, each of these rooms being accessible through a door equipped with a coded lock, which lock is controllable electrically by means of a correspondingly coded key.
The coded keys in question are preferably cards carrying a code recorded in magnetic or optical form, or else portable emitters of codes in the form of electromagnetic or ultrasonic waves, and the codes considered are numbers expressed by successions of binary signals.
The coded keys may also be formed by an incorporporeal code confided in an intelligible way to an entitled user, for example in the form of a succession of figures and/or letters, and intended to be composed on a keyboard disposed in the vicinity of the lock or to be reproduced in any other desirable way.
In the installations of the above mentioned kind, the people entitled to unlock a given lock are only temporarily so entitled and change frequently.
An ill disposed user should therefore be prevented from being able to continue unlocking the lock considered beyond the expiry of the period during which he was allowed to do so, by using a copy of the key which had been entrusted to him at that time or by using this key itself, kept by him beyond said expiry date.
To obtain such a result, it has already been proposed to automatically invalidate the key assigned to each lock by the simple presentation to this lock of a new key held by the next entitled user.
In some known embodiments of the installations designed for this purpose the code assigned to each key by a central key issuer comprises two recorded portions respectively on two distinct zones of the key, namely a first portion assigned directly to unlocking the lock, and a second portion assigned to changing the code.
For simplicity's sake, a key entrusted to a first user entitled to unlock a given lock will be called hereafter "first key" and a key subsequently entrusted to a second user whom it is desired to entitle to unlock the lock in its turn while suppressing the entitlement of the first will be called "second key", and the code portions recorded by the central key issuer on the two zones of the first key will be called respectively A and B and the code portions recorded respectively on the two zones of the second key will be called B' and C.
In known embodiments the codes B and B' are identical.
The lock concerned comprises originally means for making unlocking thereof dependent on the reading of the partial code A in the first zone of a key, means for storing the partial code B carried in the second zone of such a key having the partial code A on its first zone, and comparison means.
As long as the correct first key is presented to the lock reading of the partial code A of its first zone provides directly unlocking of this lock and the partial code B is only stored in memory.
During presentation of the second key, the section for locking the lock no longer reads the correct partial code A in the first zone of this key, but the partial code B.
It is then that the comparison means of the lock come into action: they compare the partial code (here B) previously stored and coming from the second zone of the first key with the new partial code read from the first zone of the second key.
The resulting identification of such a comparison results in unlocking the lock, of causing the code thus identified to be adopted by the lock, that is to say here the partial code B. as new unlocking code and in invalidating, by deletion or otherwise, the initial partial unlocking code A.
It is then the partial code C of the second zone of the second key which plays the role of the preceding partial code B, and so on.
Such an approach--in particular forming the subject matter of U.S. Pat. Nos. 3,821,704, 3,860,911, 4,207,555 and 4,213,118 --has the important advantage of allowing automatic invalidation of the out of date keys by the simple subsequent use of the valid keys without it being necessary to make any other local changes.
But it is not proof against frauds.
In fact, it is relatively easy for an ill disposed user who succeeds in obtaining two successive entitlement keys assigned to the same lock, by comparing the codes recorded on these two keys, to detect the partial code common thereto, namely B in the above example and so to deduce therefrom the partial unlocking code (here C) of the next key in the series corresponding to the lock considered and to provide such a following key himself without the knowledge and in the place of the central key issuer.
With this next key, although "falsely" issued, the lock considered can be unlocked as well as with the next "true" key.
To benefit from the advantage mentioned above while making impossible the fraud which has just been mentioned it has been proposed, in a control and monitoring installation comprising again, as before, an issuer for preparing coded keys for controlling the locks and a reader associated with each lock, adapted for unlocking this lock on simple presentation thereto of a correctly coded key, this issuer and this reader being adapted so that detection by said reader of the code y recorded by said issuer on each new key of order p assigned to the lock associated with this reader causes invalidation of the code x recorded on the key of order p-1 previously assigned to this lock, to make each code y derivable from code x by an algorithm y=f(x) stored at least in the issuer.
By "algorithm" is meant in the present text a set of digital operations causing a second number y to correspond to a first number x.
Each of the issuing and reading apparatus is then equipped so as to use the algorithm in an appropriate way.
Thus the issuer preparing the keys successively intended for unlocking in turn the lock equipped with the reader considered is adapted so as to record respectively on the successive keys the codes x, f(x), f.sup.2 (x) . . . f.sup.n (x) . . .
In the preceding paragraph, n designates an integer, f.sup.n (x) signifies f[f.sup.n-1 (x)] and the symbol f(x) is equivalent to f.sup.1 (x).
As for the reader associated with the lock considered, it is adapted so as to successively compare the codes read from the different keys with codes x, f(x), f.sup.2 (x) . . . , f.sup.n (x) . . . and to unlock the lock when the comparison made reveals an identity.
Furthermore,. the reader is equipped with means for automatically invalidating each code f.sup.p (x) when the key bearing the code f.sup.p+1 (x) is presented thereto.
Thus, each reader-lock subassembly is adapted so that at a given time the lock may be unlocked by presentation to the reader of one or other of two codes f.sup.p (x) and f.sup.p+1 (x), the presentation of the first of these codes resulting in only unlocking of the lock whereas presentation of the second code results not only in unlocking, but also in invalidating the first code and the sensitization of the reader to the next code f.sup.p+2 (x) of the series the roles played respectively just before such a presentation of the second code f.sup.p+1 (x) by the first two codes being played respectively from this time by the two codes f.sup.p+1 (x) and f.sup.p+2 (x).
In the known embodiments of such an installation, each reader is responsive each time to two codes, namely the codes f.sup.p (x) and f.sup.p+1 (x) in the above example.
Such an approach requires strict synchronization between the issuer and each reader.
It may in fact happen that a "first key" prepared by the issuer for a given lock is not effectively used before the next key or "second key" is prepared by said issuer.
Such a fault in use causes a fault of progression in the succession of codes readable by means of the reader associated with said lock which makes the "second key" inoperative for opening said lock.
This drawback is particularly manifest when each of the keys considered is entitled to open a plurality of locks: in such a case, it may happen that one at least of said locks has not been effectively actuated by the corresponding "first key" during the period of entitlement of this key.